Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite
23Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 0.3%
exploitation probability
0.3%top 79% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
Affected products
Unknown · Defender Securitypublic PoCs found — 1
cve_referencewpscan.com/vulnerability/5adace73-b1e5-4f1b-9676-6e9619dc54c4/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.